Follow the dots

Yesterday, I did something that almost nobody does: I read the release notes for the latest iOS update. And what I found left me stunned, not because of the new features or emojis, but because of what's hiding in the security section.

I personally reviewed the official Apple security bulletins (support.apple.com) for the last five minor updates to the operating system, CVE by CVE. The average number of patched vulnerabilities had been steadily increasing, ranging from 40 to 60 per version. However, this latest update breaks the trend with a whopping 87 critical security fixes - almost 75% above that already high average.

To put it into perspective, I prepared this graph comparing the volume of patches in the last 6 versions:

What kind of patches are we talking about? When summarizing the report, these aren't superficial errors. We're seeing deep fixes for memory corruption in the Kernel, arbitrary code execution vulnerabilities in WebKit, privilege escalation failures in CoreBluetooth, and holes in the Sandbox. These are complex, labyrinthine errors that would take a team of human engineers months to audit and discover.

And this is where my speculation begins.

Speculating: the Fable 5 factor

I want to be crystal clear: I don't have any internal Apple information or leaked documents to back this up. This is pure speculation based on market observation. But as the Americans say: "follow the dots".

We know from recent press releases that Apple is massively integrating AI into its internal development processes. We also know they have strategic alliances and advanced talks with AI giants, including Anthropic.

If we recall my previous column, where I told you how the Fable model autonomously found vulnerabilities in our GitLab in a matter of minutes (charging us a fortune in the process), the jump in iOS security patches from one version to another stops looking like a purely human effort.

My hypothesis is this: Apple unleashed Fable 5 (or an AI agent with similar capabilities) on its own source code. They're using cutting-edge autonomous AI agents to audit millions of lines of legacy code, finding vulnerabilities that had been dormant in the operating system for years.

The problem of the "big pockets"

If I'm right, should we be thrilled as iPhone users? Our phone is now much more secure. Yes, but as an industry analyst, this raises a deep concern for me.

If Fable 5 is responsible for this massive code cleanup, we're witnessing the birth of an insurmountable technological gap. As I documented a few days ago, using these cutting-edge models to audit systems is brutally expensive.

**The cost of auditing with frontier AI:** it cost my team $845 USD for the AI to find just two irrelevant issues in a few hours. Auditing a complete mobile operating system would imply, according to this logic, millions of dollars in tokens and API consumption.

Imagine the computational cost of auditing the most widely used mobile operating system in the world. We're talking about millions of dollars in tokens and API consumption.

Apple, Microsoft, Google, and international banks have the "big pockets" to pay for this. They have unrestricted access - and preferential volume agreements - to the most advanced models in the world. They can afford to have Fable 5 running 24/7, shielding their systems from zero-days.

But what about small and medium-sized businesses? What about the startup developing accounting software in Mexico? What about the regional hospital with its own management system?

They can't afford the Fable bill. They'll have to keep relying on annual human audits or traditional vulnerability scanners that are lightyears away from the reasoning capability of a frontier model.

The new era of asymmetric insecurity

I don't think this gap is going to close anytime soon. As long as the inference cost of truly advanced models remains prohibitive, cybersecurity will become a corporate luxury.

Large companies will be impenetrable digital fortresses audited by AI, while the rest of the market will be an open field of legacy vulnerabilities waiting to be exploited (ironically, by cybercriminals who will also use AI to find them).

Let's see what the future holds. I'm sure that in the coming months, this trend will be confirmed, there will be leaks, and we'll know if I'm wrong or if Apple has indeed inaugurated the era of "automated elite cybersecurity".

What do you think? Do you see this security gap widening in your industries?